Build a Booking Platform in Lovable

Replace the current client-side slot availability check with an Edge Function that uses a Postgres advisory lock to prevent race conditions.

Update get-available-slots/index.ts:
1. Accept POST with { staff_id, service_id, date } in the request body
2. Call supabase.rpc('compute_open_slots', { p_staff_id, p_service_id, p_date }) to get available timestamps
3. Return the list of slot timestamps as JSON

Create create-booking/index.ts:
1. Accept POST with { staff_id, service_id, starts_at, service_duration_min, customer_email, intake_notes }
2. Verify caller is authenticated via Authorization header
3. Run: SELECT pg_advisory_xact_lock(hashtext('booking:' || staff_id::text)) — this holds a transaction-scoped advisory lock per staff member so two concurrent requests queue instead of racing
4. Compute ends_at = starts_at + duration interval
5. INSERT into bookings. If the INSERT fails with Postgres error code 23P01 (exclusion violation), return HTTP 409 with body { error: 'Slot was just taken by someone else — please pick another time' }
6. Return the new booking id and confirmation details

Update the BookingWizard Step 5 Confirm button to call supabase.functions.invoke('create-booking', {...}) instead of a direct Supabase INSERT.

Add Stripe deposit collection to the booking flow.

1. Cloud tab → Secrets: confirm STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET are set.

2. Create supabase/functions/create-deposit-session/index.ts:
   - Accept POST with { booking_id }
   - Fetch the booking + service from the database
   - If service.deposit_cents = 0, return { skip: true } — no deposit needed
   - Create Stripe Checkout session: mode='payment', line_items with service.deposit_cents, metadata.booking_id, success_url='/book/confirmation?booking_id={booking_id}', cancel_url='/book'
   - Return { url: session.url }

3. Update supabase/functions/stripe-webhook/index.ts:
   - Read raw body: const body = await req.text();
   - Verify: const event = await stripe.webhooks.constructEventAsync(body, req.headers.get('Stripe-Signature'), Deno.env.get('STRIPE_WEBHOOK_SECRET'));
   - On checkout.session.completed: read metadata.booking_id, UPDATE bookings SET deposit_paid=true, status='confirmed' WHERE id=booking_id
   - Return 200

4. In BookingWizard Step 5: if service.deposit_cents > 0, after create-booking succeeds, immediately call create-deposit-session with the new booking_id and redirect to session.url. If deposit_cents = 0, go straight to /book/confirmation.

Add booking confirmation and reminder emails via Resend.

1. Create supabase/functions/send-booking-email/index.ts. Accept POST with { booking_id, type } where type is one of: 'confirmation', 'reminder_24h', 'reminder_1h', 'cancelled'.
   - Fetch booking + service + staff from the database using the service role client
   - Build the email subject and body based on type:
     - confirmation: 'Your booking is confirmed — [Service] with [Staff] on [Date] at [Time]'
     - reminder_24h: 'Reminder: [Service] with [Staff] tomorrow at [Time]'
     - reminder_1h: '[Service] with [Staff] in 1 hour'
     - cancelled: 'Your booking has been cancelled'
   - POST to Resend API with RESEND_API_KEY
   - Return { success: true }

2. Call send-booking-email with type='confirmation' from the stripe-webhook handler on checkout.session.completed (if deposit required) and from the create-booking Edge Function for free bookings.

3. Set up reminder scheduling via pg_cron:
   In Cloud tab → Database → SQL Editor:
   CREATE EXTENSION IF NOT EXISTS pg_cron;
   SELECT cron.schedule('hourly-reminders', '0 * * * *', $$
     SELECT net.http_post(
       url := '[your-edge-function-url]/send-booking-email',
       body := row_to_json(b)::text
     )
     FROM bookings b
     JOIN services s ON s.id = b.service_id
     WHERE b.status = 'confirmed'
       AND b.starts_at BETWEEN now() + interval '23 hours' AND now() + interval '25 hours'
       AND b.reminder_24h_sent = false;
   $$);

Add a cancellation policy that refunds the deposit if the customer cancels more than 24 hours before the appointment.

1. Create supabase/functions/cancel-booking/index.ts:
   - Accept POST with { booking_id }
   - Verify caller owns the booking (customer_id = auth.uid())
   - Check hours until appointment: EXTRACT(EPOCH FROM (starts_at - now())) / 3600
   - If > 24 hours AND deposit_paid = true:
     - Call stripe.refunds.create({ payment_intent: stripe_payment_intent_id })
     - UPDATE bookings SET status='cancelled', deposit_paid=false
     - Send cancellation email via send-booking-email
   - If <= 24 hours: return 400 with message 'Cancellations within 24 hours of the appointment are non-refundable per our policy'
   - If deposit not paid: just UPDATE status='cancelled' and send cancellation email

2. On /my-bookings, the Cancel button should call this Edge Function instead of doing a direct Supabase UPDATE. Show the 24-hour policy text next to the button: 'Cancel for free if more than 24h before appointment. Cancellations within 24h are non-refundable.'

3. Show the policy text on the /book Step 5 review page too, before the Confirm button.

Fix slot display to correctly handle staff and customers in different timezones.

1. Confirm the compute_open_slots function works in the staff member's timezone:
   - In the function, convert p_date to the staff's timezone: p_date AT TIME ZONE staff.timezone
   - Generate slot start times in staff timezone: availability.start_time, availability.end_time
   - Return slots as timestamptz (UTC) — Postgres will handle the conversion

2. In DateGridSlotPicker, display slot times in the customer's browser timezone using Intl.DateTimeFormat:
   const formatted = new Intl.DateTimeFormat(undefined, { hour: 'numeric', minute: '2-digit', timeZoneName: 'short' }).format(slotDate);
   This automatically shows times in the customer's local time with the timezone abbreviation.

3. On the admin /admin/bookings page, show times in the staff member's timezone (use staff.timezone string with Intl.DateTimeFormat({ timeZone: staff.timezone })).

4. Add a visible label below the slot picker: 'All times shown in your local timezone ([detected TZ])'. Detect browser TZ with: Intl.DateTimeFormat().resolvedOptions().timeZone.

5. Add a test: create a staff member in EST, load the slot picker as a browser in PST, and verify the slot times display correctly offset (an EST 9am slot should show as 6am PST).

Add a blocked-time feature so staff can block specific date ranges for vacations, sick days, or lunch breaks.

1. Create a blocked_times table: id (uuid pk), staff_id (uuid references staff(id) on delete cascade), starts_at (timestamptz not null), ends_at (timestamptz not null), reason (text). RLS: public SELECT (needed for slot computation); admin write.

2. Update compute_open_slots to subtract blocked_times from the generated slots:
   In the function body, after generating candidate slots, filter out any slot where starts_at OVERLAPS with a blocked_times row for that staff member:
   AND NOT EXISTS (
     SELECT 1 FROM blocked_times bt
     WHERE bt.staff_id = p_staff_id
     AND tstzrange(bt.starts_at, bt.ends_at) && tstzrange(slot_start, slot_start + (p_duration_min || ' minutes')::interval)
   )

3. On /admin/availability, add a 'Block time' button per staff member. Clicking opens a Dialog with: start datetime picker, end datetime picker, reason text input, and Save button. The blocked time appears as a red chip on the availability grid.

4. Allow staff members to add their own blocked times: add a /my-availability page accessible to users where staff.user_id = auth.uid(), showing upcoming blocked times + an 'Add block' button.